Max Vozeler from the Debian Audit Project discovered that pstopnm, aconverter from Postscript to the PBM, PGM and PNM formats, launchesGhostscript in an insecure manner, which might lead to the executionof arbitrary shell commands, when converting specially crafted Postscriptfiles.

For the old stable distribution (woody) this problem has been fixed inversion 9.20-8.6.

For the stable distribution (sarge) this problem has been fixed inversion 10.0-8sarge3.

For the unstable distribution (sid) this problem has been fixed inversion 10.0-9.

We recommend that you upgrade your netpbm package.

Upgrade Instructions- --------------------

wget url will fetch the file for youdpkg -i file.deb will install the referenced file.

If you are using the apt-get package manager, use the line forsources.list as given below: